RESUMABLE: Section 4.2 should describe what happens with GET requests to the request resource

[LPardue]

During WGLC review, @MikeBishop raised the following issue on https://lists.w3.org/Archives/Public/ietf-http-wg/2025JulSep/0123.html

Relatedly, Section 4.2 should describe what happens with GET requests to the request resource. Even if they're not needed as part of the upload flow, they almost certainly will happen occasionally as curious devs see these requests in network debugging tools and investigate what they are. Servers should have guidance on how to handle them.

[wtarreau]

As I mentioned in #3213 I think we must not mandate giving access to the partial upload because being partial means it cannot have been inspected for malware or anything, and that this could open a weakness by which users upload partial contents that can be retrieved without inspection. IMHO here GET should retrieve the same response as HEAD, i.e. the upload is not complete, the data are still in the quarantine upload location and not accessible. I'm more in favor of 201 created for both since it reports the most accurate known status about that resource but that's a detail.

[Acconut]

No objection was raised during IETF 124 for this. Let's add a paragraph saying that a GET request should generate the same headers as a HEAD request. This would also help intermediary who want to switch between GET and HEAD as the request methods. I don't think we have to put any requirements on the response body.

[Acconut]

Opened #3467 for this.